What is the CVSS score of CVE-2026-33512?

CVE-2026-33512 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-33512?

WWBN AVideo instances (versions ≤26.0) are vulnerable to unauthorized decryption of sensitive tokens and metadata through an unauthenticated API endpoint, potentially exposing protected content…

How to fix or mitigate CVE-2026-33512?

Within 24 hours: Identify all WWBN AVideo instances in your environment and document their versions and network exposure. Within 7 days: Implement network-level access controls to restrict the /api/plugin/decryptString endpoint, deploy WAF rules to block API calls to this endpoint, and isolate affected systems from untrusted networks if possible. Within 30 days: Contact WWBN for patch availability, evaluate upgrade to patched versions when released, or plan migration to alternative video platforms if patch is not forthcoming.

PHP CVE-2026-33512

EUVD-2026-14479 HIGH

Improper Authentication (CWE-287)

2026-03-23 GitHub_M

PHP Authentication Bypass

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 23, 2026 - 18:45 euvd

EUVD-2026-14479

Analysis Generated

Mar 23, 2026 - 18:45 vuln.today

CVE Published

Mar 23, 2026 - 18:17 nvd

HIGH 7.5

DescriptionGitHub Advisory

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the API plugin exposes a decryptString action without any authentication. Anyone can submit ciphertext and receive plaintext. Ciphertext is issued publicly (e.g., view/url2Embed.json.php), so any user can recover protected tokens/metadata. Commit 3fdeecef37bb88967a02ccc9b9acc8da95de1c13 contains a patch.

AnalysisAI

WWBN AVideo versions up to and including 26.0 contain an unauthenticated API endpoint that allows arbitrary decryption of ciphertext. Attackers can exploit the decryptString action in the API plugin without authentication to decrypt publicly-issued ciphertext (such as from view/url2Embed.json.php), allowing recovery of protected tokens and metadata. The CVSS score of 7.5 reflects high confidentiality impact with network accessibility and no authentication required.

Technical ContextAI

This vulnerability affects WWBN AVideo (cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*), an open-source PHP-based video platform. The root cause is CWE-287 (Improper Authentication), where the API plugin's decryptString action fails to implement any authentication mechanism before processing decryption requests. The platform issues encrypted tokens and metadata publicly through endpoints like url2Embed.json.php, and the unauthenticated decryption endpoint creates a cryptographic oracle that completely undermines the confidentiality these encryption measures were meant to provide. This represents a fundamental security design flaw where cryptographic protection is rendered ineffective by an accessible decryption service.

RemediationAI

Upgrade WWBN AVideo to a version containing the patch from commit 3fdeecef37bb88967a02ccc9b9acc8da95de1c13 or later. The patch details are available at https://github.com/WWBN/AVideo/commit/3fdeecef37bb88967a02ccc9b9acc8da95de1c13 and the security advisory at https://github.com/WWBN/AVideo/security/advisories/GHSA-mwjc-5j4x-r686. Until patching is completed, organizations should implement network-level access controls to restrict API access to trusted IP ranges only, disable the API plugin if not required for operations, or implement authentication requirements at the web server or reverse proxy level for all API endpoints. Monitor logs for suspicious decryptString API calls to detect potential exploitation attempts.